Splunk Search

Negate the field containing both the values in SPLUNK query

Janani_Krish
Path Finder

Hi,

I have written following query where a field consisting of 2 actions as below,

Query:
sourcetype="my_sourcetype" session_id="1011" |eval indicator=mvappend(src,dest)|mvexpand indicator|stats count values(action) by indicator,session_id

Result:

indicatorsession_idcountvalue(action)
23.45.6.7810112allowed
teared
23.45.6.7910452allowed

 

Now I want to negate the field which contain both allowed and teared. Please suggest any ideas.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Like this, maybe?

sourcetype="my_sourcetype" session_id="1011" 
| eval indicator=mvappend(src,dest)
| mvexpand indicator
| stats count values(action) as actions by indicator,session_id
| where (isnull(mvfind(actions,"allowed")) AND isnull(mvfind(actions,"teared")))
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...